Bcrypt Generator & Verifier
Hash a password with an adjustable cost factor, or check one against an existing hash.
Recommended range for most applications.
How to Use
- 1. Type the password you want to hash.
- 2. Choose a cost factor — 10 to 12 suits most applications.
- 3. Click Generate Hash and copy the result.
- 4. Switch to Verify to check a password against an existing hash.
How Bcrypt Works
General-purpose hashes like SHA-256 are built to be fast, which is exactly the wrong property for passwords — an attacker holding a stolen database can test billions of guesses per second. bcrypt inverts that: it is deliberately expensive, and the expense is tunable.
The cost factor is a power of two, so each increment doubles the work. Moving from 10 to 12 makes hashing four times slower for you and four times slower for an attacker. As hardware improves you raise the cost; the algorithm itself does not need to change.
A bcrypt hash is self-describing. $2b$12$ records the algorithm version and cost, the next 22 characters are the random salt, and the remaining 31 are the digest. Because the salt lives inside the hash, the same password produces a different hash every time — which is why you verify with a compare function rather than re-hashing and comparing strings.
One real limitation: bcrypt only reads the first 72 bytes of input. Longer passphrases are silently truncated, so two different long inputs sharing a prefix can validate against the same hash.
Related: Hash Generator, Password Generator, and Password Strength Checker.
Frequently Asked Questions
What makes bcrypt better than SHA-256 for passwords?
Speed is the point. SHA-256 is designed to be fast, which helps an attacker try billions of guesses per second against a stolen database. bcrypt is deliberately slow and its cost is adjustable, so you can keep raising it as hardware improves.
What is the cost factor?
It sets how many rounds of work each hash takes, as a power of two — so cost 12 is four times slower than cost 10. Ten to twelve is the common recommendation: slow enough to frustrate attackers, fast enough not to delay a login.
Why does the same password give a different hash each time?
bcrypt generates a random salt for every hash and stores it inside the result. That is why two users with the same password get different hashes, and why you verify with a compare function rather than by re-hashing and comparing strings.
Is my password sent anywhere?
No. Hashing and verification run entirely in your browser using the bcryptjs library. That said, this is a developer testing tool — do not paste a real production password or a live database hash into any website, including this one.
Does bcrypt have a length limit?
Yes — bcrypt only considers the first 72 bytes of a password and silently ignores the rest. The tool warns you when your input exceeds that, since it means two different long passwords could produce the same hash.
Was this tool helpful?
More Tools
Related Security
TOTP Generator
File Checksum Verifier
Barcode Generator
QR Code Scanner
You Might Also Like